{"id":"CVE-2022-4111","aliases":["EUVD-2022-7364","GHSA-hgp8-w8fj-r4cm"],"status":"published","title":"Improper Validation of Specified Quantity in Input in tooljet/tooljet","description":"Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0082,"percentile":0.57515,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284","CWE-400"],"published":"2022-11-22T00:00:00Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"npm","package":"tooljet","fixed_in":["1.27.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tooljet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"npm","package":"tooljet","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]}],"products":[{"vendor":"tooljet","product":"tooljet"},{"vendor":"tooljet","product":"tooljet/tooljet"}],"references":[{"url":"https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4111","tags":["advisory"]},{"url":"https://github.com/ToolJet/ToolJet/pull/4103","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hgp8-w8fj-r4cm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4111.json","tags":["advisory"]},{"url":"https://github.com/ToolJet/ToolJet","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-4111","title":"Improper Validation of Specified Quantity in Input in tooljet/tooljet","description":"Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.\n\n","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-24T20:07:23.86Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:34:37.932195Z"}],"euvd":[{"id":"EUVD-2022-7364","description":"Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.\n\n","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-24T20:07:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:03.523577Z"}],"ghsa":[{"id":"GHSA-hgp8-w8fj-r4cm","title":"ToolJet is vulnerable to Denial of Service (DoS)","description":"ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0.\n\n`tooljet` is no longer listed on npmjs.com but was [listed on npmjs.com in the past](https://web.archive.org/web/20220210014826/https://www.npmjs.com/package/tooljet). This advisory is maintained for historical completeness.","status":"published","published":"2022-11-22T03:30:56Z","modified":"2023-07-11T13:52:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-1284"],"updated_at":"2026-11-02T14:36:56.605555Z"}],"nvd":[{"id":"CVE-2022-4111","description":"Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.\n\n","status":"published","published":"2022-11-22T03:15:14.207Z","modified":"2026-06-17T05:19:59.073Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"CVE-2022-4111","title":"Improper Validation of Specified Quantity in Input in tooljet/tooljet","description":"Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.\n\n","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-10-28T02:30:59.402878502Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-hgp8-w8fj-r4cm","title":"ToolJet is vulnerable to Denial of Service (DoS)","description":"ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0.\n\n`tooljet` is no longer listed on npmjs.com but was [listed on npmjs.com in the past](https://web.archive.org/web/20220210014826/https://www.npmjs.com/package/tooljet). This advisory is maintained for historical completeness.","status":"published","published":"2022-11-22T03:30:56Z","modified":"2023-11-08T04:10:27.02646Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1284","CWE-400"],"updated_at":"2026-11-02T15:46:49.28217Z"}]}}